TÜV Rheinland

Cologne – – September 15, 2026 -- Manufacturers of connected devices, industrial controls, routers and software products face their first binding reporting deadline under the EU Cyber Resilience Act (CRA) on September 11, 2026, when mandatory notification of actively exploited vulnerabilities and severe security incidents begins via a centralized EU reporting platform.

Manufacturers must report exploited flaws within 24 hours

Under the CRA, manufacturers must submit an early warning within 24 hours of learning that a vulnerability in their own product is being actively exploited, followed by a supplementary report within 72 hours. A final report is due no later than 14 days after a remediation or risk-mitigation measure is implemented.

Severe security incidents affecting product security carry the same 24-hour and 72-hour notification windows, with a final report required within one month of the incident report.

Shanghai – September 07, 2026 -- APsystems' APstorage 261L liquid-cooled commercial and industrial energy storage system has passed the UL 9540A fire propagation test under the witness of TÜV Rheinland, with thermal runaway fully contained within a single cabinet and no propagation to adjacent units.

Cabinet Withstands Test at Full Charge With Fire Suppression Disabled

The test subjected the APstorage 261L to extreme conditions, operating at 100% state of charge with its fire suppression system intentionally switched off. No short circuit, fire spread, or explosion occurred, and the cabinet retained structural integrity throughout.